# GEOIP / Nginx logs, no drop down in map visual **URL:** \ **Category:** Kibana\ **Created:** [June 28, 2017, 1:02pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106 "2017-06-28T13:02:23Z")\ **Posts on this page:** 17\ **Page:** 2
**Author:** ![josebonillajr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josebonillajr/32/20137_2.png) [@josebonillajr](https://discuss.elastic.co/u/josebonillajr)\ **Post date:** [July 17, 2017, 10:53pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/21 "2017-07-17T22:53:10Z")
I got mine working by adding this ``` "geoip" : { "dynamic": true, "properties" : { "ip": { "type": "ip" }, "location" : { "type" : "geo_point" }, "latitude" : { "type" : "half_float" }, "longitude" : { "type" : "half_float" } } } ``` to my filebeat.template.json file. After I refreshed the filebeat index pattern everything began to pickup properly ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 18, 2017, 8:38am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/22 "2017-07-18T08:38:16Z")
Interesting, I have the following and it doesn't work. ``` "geoip": { "properties": { "continent_name": { "ignore_above": 1024, "type": "keyword" }, "country_iso_code": { "ignore_above": 1024, "type": "keyword" }, "location": { "type": "geo_point" } "latitude": { "type": "half_float" } "longitude": { "type": "half_float" } } }, ``` I find it strange that I never have a field for "location" only ever "geoip.location.lon" "geoip.location.lat" I must admit I got fed up with this and stopped troubleshooting it, even with a fresh install I have this problem. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 18, 2017, 8:45am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/23 "2017-07-18T08:45:07Z")
> [@runtman](#): > > I find it strange that I never have a field for "location" only ever "geoip.location.lon" "geoip.location.lat" That means that there is something populating those fields instead of `geoip.longitude` and `geoip.latitude` and `geoip.location`, which are what is defined in the template/mapping. ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 18, 2017, 9:04am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/24 "2017-07-18T09:04:14Z")
I understand, but how? I have posted the template, I have loaded the template and I have refreshed fields. The only host sending logs to "filebeat-\*" right now is the one using this prospector setup. ``` - input_type: log paths: - /var/log/nginx/webdev/error.log document_type: nginx.error tags: ["nginx_webdev"] - input_type: log paths: - /var/log/*.log document_type: generic_log tags: ["generic_log"] - input_type: log paths: - /var/log/syslog document_type: syslog tags: ["syslog"] - input_type: log paths: - /var/log/nginx/training/error.log document_type: nginx.error tags: ["nginx_training"] - input_type: log paths: - / /var/log/nginx/dev/error.log document_type: nginx.error tags: ["nginx_dev"] - input_type: log paths: - /var/log/nginx/webdev/access.log document_type: nginx.access tags: ["nginx_webdev"] - input_type: log paths: - /var/log/nginx/dev/access.log document_type: nginx.access tags: ["nginx_dev"] - input_type: log paths: - /var/log/nginx/training/access.log document_type: nginx.access tags: ["nginx_training"] - input_type: log paths: - /var/log/nginx/analytics18/access.log document_type: nginx.access tags: ["nginx_a18"] - input_type: log paths: - /var/log/nginx/analytics18/error.log document_type: nginx.error tags: ["nginx_a18"] - input_type: log paths: - /var/log/nginx/*.log document_type: nginx tags: ["nginx_base"] ``` Logstash ``` filter { if [type] == "nginx.access" { grok { match => { "message" => "%{HTTPD_COMBINEDLOG}" } } geoip { source => "clientip" } } if [type] == "nginx.error" { grok { match => { "message" => "%{HTTPD20_ERRORLOG}" } } geoip { source => "clientip" } } if [type] == "nginx" { grok { match => { "message" => "%{HTTPD_COMBINEDLOG}" } } geoip { source => "clientip" } } } ``` Example of what I am seeing. ![](https://us1.discourse-cdn.com/elastic/original/3X/4/5/45732d8b0d261bbc9754437db533875e140bb322.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 18, 2017, 9:07am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/25 "2017-07-18T09:07:05Z")
Ok, well which type has this incorrect data? ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 18, 2017, 9:10am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/26 "2017-07-18T09:10:05Z")
I would say neither have incorrect data, but from earlier in this thread you stated I needed to see the field geoip.location, which I don't have. This is my issue here ![](https://us1.discourse-cdn.com/elastic/original/3X/b/0/b00be05d06f777c95dd6e4fec68cf365927fadef.png) I get 4 options there, none of which plot to the graph. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 18, 2017, 9:12am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/27 "2017-07-18T09:12:00Z")
Yep understand. But you have `geoip.location.longitude` and `geoip.location.latitude`, so which of the types in your Logstash config is generating these fields - `nginx.access`, `nginx.error`, `nginx`. ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 18, 2017, 9:15am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/28 "2017-07-18T09:15:27Z")
nginx.access ![](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c406aca4ed56411469dde1c43726a6f8d693f7a0.png) Is this what you mean? The only relevant configs have already been shared. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 18, 2017, 9:21am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/29 "2017-07-18T09:21:20Z")
Yep 🙂 There is no `geoip.location.longitude` or `geoip.location.latitude` in the pattern you are using in the grok, so there has to be something else that is creating these from your config somewhere. Can you share the entire config, even via PM? ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 18, 2017, 9:28am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/30 "2017-07-18T09:28:24Z")
Configs have been supplied via a PM (Already shared in an earlier post) ---
**Author:** ![josebonillajr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josebonillajr/32/20137_2.png) [@josebonillajr](https://discuss.elastic.co/u/josebonillajr)\ **Post date:** [July 18, 2017, 1:58pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/31 "2017-07-18T13:58:49Z")
I think if you add the snippet to your json template and re-upload it you should have success. I added it around line 272. ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 18, 2017, 3:27pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/32 "2017-07-18T15:27:12Z")
Sorry? I posted earlier that I already had the vars in the snippet you posted. > [@GEOIP / Nginx logs, no drop down in map visual](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/22): > > Interesting, I have the following and it doesn't work. "geoip": { "properties": { "continent\_name": { "ignore\_above": 1024, "type": "keyword" }, "country\_iso\_code": { "ignore\_above": 1024, "type": "keyword" }, "location": { "type": "geo\_point" } "latitude": { … The only missing parameter was "dynamic" i will try to add that now. ---
**Author:** ![josebonillajr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josebonillajr/32/20137_2.png) [@josebonillajr](https://discuss.elastic.co/u/josebonillajr)\ **Post date:** [July 19, 2017, 12:37pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/33 "2017-07-19T12:37:20Z")
I did these things: 1. I followed this post [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) 2. I used this template which is a newer template from git [https://github.com/elastic/beats/blob/5.x/filebeat/filebeat.template.json](https://github.com/elastic/beats/blob/5.x/filebeat/filebeat.template.json) 3. The I added this: ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 20, 2017, 7:41am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/34 "2017-07-20T07:41:12Z")
Thanks for that, I have run through that and have the same outcome, it's not plotting the graph. ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 27, 2017, 10:34am UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/35 "2017-07-27T10:34:44Z")
This is interesting. I removed my nginx filters, and stopped passing nginx logs. Added the following syslog grok ``` filter { if [type] == "syslog" { if [message] =~ /last message repeated [0-9]+ times/ { drop { } } grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } geoip { source => "[system][auth][ssh][ip]" target => "[system][auth][ssh][geoip]" } ``` Almost immediately, I had the following field available: `system.auth.ssh.geoip.location` So I am assuming, my filter for nginx needs tweaking? ---
**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\ **Post date:** [July 28, 2017, 1:15pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/36 "2017-07-28T13:15:24Z")
Stopped using the ansible code deployed by elasticsearch them selves, installed everything manually and I still have the issues. Installed ES on 1 node. Installed Logstash on 1 node Installed Filebeat, did not point service at node Loaded newest template to logstash for filebeat Setup filebeat to talk to logstash. Same difference. What am I missing here? The logs pass any grok I give to it, and as per [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) ``` %{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields} 109.224.195.109 - - [27/Jul/2017:10:38:06 +0000] "PUT /hq/ae/devTes/agent_group/001499349052081797 HTTP/1.1" 201 148 "-" "python-requests/2.11.0" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2017, 1:15pm UTC](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106/37 "2017-08-25T13:15:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/geoip-nginx-logs-no-drop-down-in-map-visual/91106.md?page=1)